CVE-2021-3020
First published: Fri Aug 26 2022(Updated: )
An issue was discovered in ClusterLabs Hawk (aka HA Web Konsole) through 2.3.0-15. It ships the binary hawk_invoke (built from tools/hawk_invoke.c), intended to be used as a setuid program. This allows the hacluster user to invoke certain commands as root (with an attempt to limit this to safe combinations). This user is able to execute an interactive "shell" that isn't limited to the commands specified in hawk_invoke, allowing escalation to root.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| ClusterLabs Hawk | <=2.3.0-15 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this issue?
The vulnerability ID of this issue is CVE-2021-3020.
What is the severity of CVE-2021-3020?
The severity of CVE-2021-3020 is high with a CVSS score of 8.8.
What software is affected by CVE-2021-3020?
ClusterLabs Hawk versions up to and including 2.3.0-15 are affected by this vulnerability.
How can the hacluster user exploit CVE-2021-3020?
The hacluster user can exploit CVE-2021-3020 to invoke certain commands as root.
Are there any fixes or patches available for CVE-2021-3020?
Yes, fixes and patches are available. Please refer to the references for more information.
- collector/nvd-api
- collector/nvd-index
- agent/weakness
- agent/description
- agent/severity
- agent/references
- agent/author
- agent/tags
- agent/type
- agent/event
- agent/remedy
- agent/first-publish-date
- agent/last-modified-date
- agent/softwarecombine
- vendor/clusterlabs
- canonical/clusterlabs hawk
- version/clusterlabs hawk/2.3.0-15